Threat Intelligence Operations

Effective threat intelligence operations transform raw data into actionable insight. This lesson covers collection, processing, and integration of threat intelligence into security operations.

Collection Sources

Open source intelligence (OSINT) - Publicly available information: threat reports, malware repositories, vulnerability databases, social media, and security community forums.

Commercial feeds - Paid services providing curated indicators, analysis, and alerting. Quality varies significantly between providers.

Information sharing communities - ISACs (Information Sharing and Analysis Centers) and industry groups share threat data among members.

Internal intelligence - Your own security tools generate indicators: malware samples from EDR, blocked domains from proxy, attack IPs from firewall logs.

Processing Intelligence

Raw indicators require context to become intelligence:

Validation - Confirm indicators are accurate. Check for known false positive sources.

Enrichment - Add context: registration data for domains, geolocation for IPs, file metadata for hashes.

Relevance assessment - Does this threat target your industry or technology stack? A mobile banking trojan matters little to a manufacturing company.

Aging - Indicators decay. Attacker infrastructure changes. Set expiration policies.

Integration with Detection

SIEM integration - Match log events against indicator lists. Alert on connections to malicious IPs, queries for known-bad domains, presence of malware hashes.

Firewall/proxy blocks - Proactively block known-bad destinations. Balance aggressive blocking against false positive risk.

EDR lookups - Check file hashes and network connections against threat intelligence.

Email security - Flag messages from known-bad senders or containing suspicious URLs.

Evaluating Sources

Not all intelligence is equal. Evaluate sources on:

Timeliness - How quickly do they publish new indicators?

Accuracy - What is their false positive rate?

Relevance - Do they cover threats targeting you?

Context - Do they provide explanation, not just indicators?

Actionability - Can you actually use the intelligence?

Track which sources provide value through validated findings. Invest in sources that produce results.